Arnold Chan
@slazTrusted contributorCompletionist
2 followers1,966 downloads3,578 copies44 likes20,398 views
7,399 detections
Filters
Last updated
All Time
Detection languages
5,494
1,006
394
169
98
Categories
2,311
1,792
1,178
1,003
910
Platforms
4,111
1,552
1,220
660
658
Products / Services
2,750
1,003
991
705
485
MITRE Techniques
2,072
1,500
1,388
1,065
536
CVEs
38
33
24
22
21
IDS Classtypes
477
179
104
79
52
IDS Protocols
554
156
144
86
18
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
Detects instances where the Grafana MCP (Model Context Protocol) server's service account identity executes administrative tools (such as 'grafana_api_request') within a session that lacks a verified, prior authentication event (bearer token). This pattern suggests an adversary may be spoofing or hijacking a privileged service account session to perform unauthorized administrative actions.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Page 723 of 740